Attackers are exploiting the hack of adulterer website Ashley Madison to disseminate spam and malware across the web. In July, Brian Krebs reported that a group of hackers known as The Impact Team had released some sensitive internal data stolen from Avid Life Media (ALM), a Toronto-based company that owns Ashley Madison as well as other hookup services including Cougar Life and Established Men. The information pertained to a small group of Ashley Madison users. However, The Impact Team did threaten to expose the information of all 37 million users unless ALM took Ashley Madison and Established Men offline permanently. No subsequent information from Ashley Madison users has been leaked online. But this has not stopped attackers from creating the false impression that it has.
According to BBC News, spammers are claiming that stolen Ashley Madison data has been posted online to a number of websites including Pastebin and Slexy. The news organization visited the links to those supposed leaks and discovered them to be fake, with many of the URLs leading to lists of emails and passwords that have been in circulation since at least 2011. That is not all that the BBC found, however. Other links posted by scammers led to webpages that contained "scareware," a type of malware that lures victims into downloading unwanted and potentially harmful software after posting fake pop-ups warning users that their computers have become infected with viruses. Other links required users to complete a survey or sign up for a service in order to access the stolen data, whereas a small number of links led to images, text, and videos laced with malware that attempted to install itself on Windows PCs. These fake links are a common tactic used by spammers in the event of a high-profile security incident such as the Ashley Madison hack, reveals Pastebin head Jeroen Vader.
"Spammers will always try to abuse any trend to get some free exposure, and this Ashley Madison leak is no exception," explains Vader. "It is hard for us to remove everything, but we do actively search for such posts."
Users are urged to exercise caution when clicking on unknown links on the web, especially if they purport to direct visitors to lists of stolen information.
